The recent debate over gun control made me stop and think again about the purpose of risk management. Is it to identify the worst losses and allocate resources to preventing those? Or is it to prevent the losses that sound the worst?

I decided to do a little research on causes of death. Here in the US, we tend to have a skewed way of looking at such things. We look at individual deaths and weigh them based on the person. The death of thousands of nameless people due to heart disease carries less weight than the death of one child whose life is exhibited on television.

According to the CDC, the top three preventable causes of death are Smoking, Obesity and Alcohol. Smoking and obesity drive about 450,000 deaths a year....EACH. Alcohol causes about 95,000.

Now, if I was a risk manager and the company was losing $900,000 a year due to employee theft, and $11,000 due to auto accidents, the choice would be simple: focus on stopping the theft.

But somehow the world of public health does not work this way (at least not where politicians are concerned). There is no major discussion going on nationally about outlawing alcohol and cigarettes. Instead we work about terrorism, or gun deaths, or e-coli outbreaks. Swimming pools cause more deaths than many of the things we spend most of out time on.

But perhaps I am being harsh. I once worked for a company on the audit team. We discovered a pricing problem that was causing a verified loss of $100 million a year. However, the chief executive was far more concerned that year with avian flu, which never cost the company a dime. The company is no longer in business (shocking, I know).

I do wonder how long any institution can last when it spends the majority of its resources on risks with very low severity. Unfortunately while one can choose a different company, one is more or less stuck with one's country. Being someone who likes to take charge of fixing these things, it is very difficult to sit idly by. ​